Security

Abuse controls

• Cloudflare Turnstile is verified server-side on every submission, and the token must have been solved on your own site.
• A honeypot field catches the simplest bots.
• Rate limits apply per visitor and per form.
• An origin allowlist restricts which sites may post to your endpoint.

We do not treat browser CORS as a security boundary. A browser honours it; a script or command-line client can send whatever origin it likes. Turnstile, the rate limits, fixed destinations, and validation are the controls that do the real work.

Email construction

• Control characters are stripped from every value, and newlines from every single-line field, so nothing submitted can introduce an email header.
• Messages are assembled by Amazon SES from structured fields, not by us pasting strings into headers.
• The visitor's address is used as Reply-To only after validation, and always without a display name.
• All content is escaped in the HTML part. There are no remote images, no tracking pixels, no attachments, and no clickable links built from submitted text.

If something goes wrong

Any form or client can be paused immediately without deleting its configuration, and re-enabled unchanged. Report a vulnerability to security@submit-kit.com.